A financially motivated menace actor has been noticed exploiting a just lately disclosed distant code execution flaw affecting the Craft Content material Administration System (CMS) to deploy a number of payloads, together with a cryptocurrency miner, a loader dubbed Mimo Loader, and residential proxyware.
The vulnerability in query is CVE-2025-32432, a most severity flaw in Craft CMS that was patched in
Mimo Hackers Exploit CVE-2025-32432 in Craft CMS to Deploy Cryptominer and Proxyware
